A company's AI security team is evaluating the risk of adversarial examples—inputs crafted to fool an image classification AI model used for security camera analysis. The team wants to test the model's robustness to adversarial perturbations. Which approach assesses this robustness?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to generate adversarial examples with a tool like ART, then measure how well the model holds up under attack. If its accuracy drops on those crafted inputs, that tells you it's vulnerable.
Full Explanation
The correct approach is using an adversarial robustness toolbox such as ART, or similar libraries, to generate adversarial examples and measure the model's accuracy under attack. Adversarial robustness testing requires generating adversarial examples—slightly perturbed inputs designed to fool the model—using established attack methods such as FGSM, PGD, and C&W attacks, which are implemented in libraries like IBM's Adversarial Robustness Toolbox (ART) or Microsoft's Counterfit. The team measures the model's accuracy on these adversarial inputs to quantify robustness. If accuracy drops significantly, the model needs adversarial training or input preprocessing defenses. The static code analysis approach is wrong because it examines source code for programming vulnerabilities such as buffer overflows and injection flaws; it cannot detect a model's susceptibility to adversarial perturbations in input data. The approach of increasing the training dataset size is wrong because it improves generalization but does not directly address adversarial robustness—a model can be 99% accurate on clean data and still be highly susceptible to adversarial examples. The TLS encryption approach is wrong because TLS protects data in transit; it does not affect the model's susceptibility to adversarial inputs.